GSA in Practice

The How, Not the Why
Step-by-step guides to deploying, configuring and operating Microsoft Global Secure Access (GSA), covering Microsoft Entra Internet Access and Microsoft Entra Private Access.

Real portal screenshots. Practical configuration. Troubleshooting. Validation. And companion videos demonstrating the configuration in a working tenant.

Because understanding how something should work is one thing.

Proving that it actually works is another.

The How, Not the Why

My Microsoft Global Secure Access series deliberately wasn't written as a deployment guide.

That series focuses on architecture.

Why access should be designed around identity, device and application trust rather than traditional network boundaries.

Why moving away from VPN-centric thinking requires more than simply deploying another client.

And why the decisions we make around traffic forwarding, Conditional Access, internet access and private application access matter.

But architecture is only part of the story.

Eventually, somebody has to build it.

Somebody has to deploy the client, configure the forwarding profiles, create the policies and work out why something isn't behaving as expected.

And that is where this series comes in.

GSA in Practice is the implementation companion to my Global Secure Access architecture series.

Each article focuses on a specific task and walks through it from start to finish.

Not just which settings to configure, but the order to configure them, what to watch out for and how to verify the result.

Configuration is not evidence.

Every guide shows how to verify the outcome, not simply how to configure the feature.

How These Guides Work

I've deliberately designed this series to be something you can follow while working in your own tenant.

Every article follows a consistent structure.

1. Prerequisites

Before touching the configuration, we'll establish what's required.

That includes:

• Licensing requirements
• Administrative roles and permissions
• Supported devices and operating systems
• Required configuration from earlier articles
• Relevant dependencies and limitations

Where another article covers a prerequisite, I'll link directly to it.

The idea is to avoid getting halfway through a deployment before discovering something important is missing.

2. Step-by-Step Configuration

This is the practical part.

I'll walk through the configuration using real screenshots from a working Microsoft tenant.

Each step explains:

• Where to find the setting
• What to configure
• Why that particular option matters
• What the expected result should be

The steps will follow a logical deployment order, with the aim of avoiding unnecessary disruption or conflicting configuration.

Where a feature supports multiple approaches, I'll explain which approach I'm using and why.

3. Verify It Works

This is arguably the most important section.

A policy showing as configured doesn't necessarily mean traffic is behaving as expected.

Where appropriate, we'll use:

• Global Secure Access Advanced Diagnostics
• Traffic forwarding information
• Microsoft Entra sign-in logs
• Global Secure Access traffic logs
• Device and client status
• Relevant Intune reporting
• Practical allow-and-block tests

The goal is to establish what successful configuration actually looks like.

For example, if we're configuring Universal Tenant Restrictions, I don't just want to demonstrate that the policy exists.

I want to show what happens when a user attempts to access an unauthorised Microsoft 365 tenant.

Does access fail?

Where is the enforcement happening?

What does the user see?

And what evidence can we collect to demonstrate that the control is working?

If we cannot demonstrate that a control is working, we shouldn't assume that it is.

4. Troubleshooting

Things don't always work first time.

Sometimes the client is connected but traffic isn't being forwarded.

Sometimes a policy appears correct but isn't being applied.

Sometimes the behaviour is technically correct, but not what we expected.

Each article will include troubleshooting guidance based on the scenario being configured.

Where possible, I'll show the evidence that helps identify the problem rather than simply suggesting that you recreate the policy.

5. Gotchas and Lessons Learned

These are the things that caught me out.

The settings that aren't immediately obvious.

The dependencies that are easy to overlook.

The behaviour that doesn't quite match what you expected from reading the documentation.

And the occasional moment where you spend far too long troubleshooting something that turns out to have a straightforward explanation.

If I've already made the mistake, there's no reason you should have to repeat it.

6. Clean Up and Rollback

Not every configuration is intended to remain in place.

Some will be lab exercises.

Others might be pilot configurations that need to be removed or changed.

Where appropriate, I'll explain how to:

• Remove test assignments
• Disable or delete policies
• Restore the previous configuration
• Validate that the rollback was successful

This is particularly important when testing security controls that could affect user access.

7. Why It Matters

Although this is a practical series, I don't want the architecture to disappear.

Every article will link back to the relevant part of my original Global Secure Access series.

That way, if you want to understand the architectural reasoning behind a configuration, you can explore it without turning the practical guide into another lengthy design discussion.

The architecture series explains the decision.

GSA in Practice shows you how to implement and validate it.

A Note About Screenshots

Microsoft Global Secure Access continues to evolve.

Features change, portal layouts move and new capabilities are introduced.

Every practical guide will include the date it was last verified against the Microsoft portal.

If your screen looks different from mine, check that date first.

I'll update articles where practical, particularly when changes affect the configuration or expected behaviour.

However, you should always validate the current Microsoft documentation before making changes to a production environment.

Prefer to Watch?

Each guide is intended to have a companion video on YouTube.

The videos will follow the same steps as the written articles, using a working tenant to demonstrate the configuration.

Where possible, the video chapters will match the numbered steps in the article.

That means you can:

• Follow the video from beginning to end
• Jump directly to a particular configuration step
• Keep the written guide open for screenshots and references
• Return to the troubleshooting and validation sections when needed

Videos will be linked from their corresponding articles once published.

GSA in Practice YouTube playlist: Coming soon.

Who Is This Series For?

This series is primarily intended for people who need to implement and operate Global Secure Access.

That includes:

• Engineers and administrators deploying GSA
• Consultants implementing GSA for customers
• Security teams evaluating Entra Internet Access
• Network teams transitioning from traditional VPN and proxy architectures
• Organisations piloting Entra Private Access
• Anyone who has read the architecture series and now needs to build it

You don't need to read every article in order.

Each guide is designed to stand on its own, with links to any prerequisites covered elsewhere.

However, if you're starting with a new environment, following the series from the beginning will provide a logical progression.

Series Contents

The series will grow as each guide is completed and validated.

Part	Guide	Companion Video
1	Deploying the Global Secure Access Client on Windows with Intune	Coming soon
2	Checking Traffic Goes Where You Expect: Forwarding Profiles and Advanced Diagnostics	Coming soon
3	TLS Inspection and Custom Block Pages	Coming soon
4	Web Content Filtering: Baseline Profile vs Conditional Access Security Profiles	Coming soon
5	Universal Tenant Restrictions	Coming soon
6	Private Access: Your First Connector and Application	Coming soon
7	From Quick Access to Per-App Access with Application Discovery	Coming soon
8	Detecting GSA Drift with Intune Remediations	Coming soon

Articles will be linked as they're published. Companion videos will be added as they become available.

What Comes Next?

These first eight guides establish the foundations.

But there are several areas I want to explore further.

GSA and Privileged Access

How do we use Global Secure Access to strengthen privileged administrative environments?

That includes controlling which Microsoft 365 tenants an administrator can access, protecting administrative portals and integrating GSA with Privileged Access Workstations.

One scenario I'm particularly interested in is controlling access to SharePoint and OneDrive.

For example, an administrator might legitimately need to download an approved script from their organisation's SharePoint environment.

But that doesn't mean the same privileged workstation should be able to access arbitrary external Microsoft 365 tenants.

This is where Universal Tenant Restrictions and the wider GSA architecture become particularly interesting.

GSA and Microsoft Defender for Endpoint

How do the two technologies complement each other?

Where should web filtering be enforced?

What can we control at the network layer, and where do endpoint security and data protection controls become necessary?

I particularly want to explore scenarios involving AI services, document uploads and preventing unauthorised data movement.

For example:

Can we allow users to access an approved AI service while restricting how corporate information is uploaded or shared?

Which controls can actually enforce that requirement?

And where do we need additional technologies such as Microsoft Purview?

I don't want to assume that blocking a website and preventing data exfiltration are the same thing.

They're not.

That's something worth testing properly.

GSA and Conditional Access

How do we bring network access into our wider Conditional Access architecture?

And how do we prove that the policies we design are actually enforcing the access decisions we expect?

I also want to explore how these controls fit into privileged access designs, particularly when combined with device compliance, authentication strengths and dedicated administrative environments.

These subjects may become additional practical guides as the series develops.

Building Something That Actually Works

One thing I've learned from years of working with Microsoft technologies is that there's a considerable difference between understanding how a feature should work and understanding how it behaves in a real environment.

Documentation tells us what a product supports.

Architecture helps us decide how it should be used.

But implementation and testing are what tell us whether the design actually delivers the expected result.

That's what I want this series to provide.

Practical guidance.

Real configuration.

Real screenshots.

Real troubleshooting.

And, most importantly, evidence that the security controls we've implemented are doing what we intended.

Because ultimately:

Configuration is not evidence.

A successful deployment is one you can explain, operate and prove is working.

Continue Learning

If you're interested in the architecture behind Global Secure Access, start with my original series:

Microsoft Global Secure Access: Architecture and Strategy

That series explores the design principles and security decisions that underpin the practical configurations covered here.